The CycloneDX Cryptographic Component Schema — What AQRA Produces and Why the Format Matters.

Why CycloneDX — not a proprietary format

A CBOM in a proprietary dashboard format is only as useful as your subscription. A CycloneDX CBOM is portable — importable into any of the 260+ tools in the CycloneDX ecosystem (across 20+ languages), usable by your SIEM, and submittable to a regulatory auditor without going through AQRA's platform. You own the file.

Core cryptographic-component fields

Each CBOM entry includes: algorithmRef (the specific algorithm — e.g. RSA, ECDSA P-256, AES-GCM), parameterSetIdentifier (key length or curve), classicalSecurityLevel (bits of classical security), quantumSecurityLevel (NIST security level equivalent), cryptoFunctions (encrypt/decrypt/sign/verify/generate/keygen/hash), location (file path and line number where found), and relatedCryptoMaterialRefs (certificate or key the primitive uses).

Quantum-exposure extension fields (v1.7)

The quantum vulnerability score and P1–P4 migration priority are added as CycloneDX metadata extensions. A companion migration-recommendation object maps each vulnerable primitive to its NIST-standard replacement (algorithmRef → ML-KEM-768, or ML-DSA-65, or SLH-DSA-SHAKE-128s) and the specific migration phase.

Sample JSON structure

A minimal, validated CBOM entry representing a discovered quantum-vulnerable primitive:

{
  "type": "cryptographic-asset",
  "name": "RSA-2048-PKCS1v15",
  "cryptoProperties": {
    "assetType": "algorithm",
    "algorithmProperties": {
      "primitive": "pke",
      "parameterSetIdentifier": "2048",
      "classicalSecurityLevel": 112,
      "quantumSecurityLevel": 0
    },
    "oid": "1.2.840.113549.1.1.11"
  },
  "evidence": {
    "occurrences": [
      { "location": "src/auth/jwt_sign.java:142" }
    ]
  }
}

ECMA-424 Standard Reference

CycloneDX / ECMA-424 is maintained by OWASP and ratified by Ecma International. The current published edition is ECMA-424 (2nd edition, December 2025). Full specification at ecma-international.org. The OWASP CycloneDX specification is at cyclonedx.org/specification. Both are public domain — no licence required to implement.